CN105354721A - Method and device for identifying machine operation behavior - Google Patents
Method and device for identifying machine operation behavior Download PDFInfo
- Publication number
- CN105354721A CN105354721A CN201510634613.5A CN201510634613A CN105354721A CN 105354721 A CN105354721 A CN 105354721A CN 201510634613 A CN201510634613 A CN 201510634613A CN 105354721 A CN105354721 A CN 105354721A
- Authority
- CN
- China
- Prior art keywords
- user
- operation behavior
- probability
- mistiming
- occurs
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/02—Marketing; Price estimation or determination; Fundraising
- G06Q30/0207—Discounts or incentives, e.g. coupons or rebates
- G06Q30/0224—Discounts or incentives, e.g. coupons or rebates based on user history
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/953—Querying, e.g. by the use of web search engines
- G06F16/9535—Search customisation based on user profiles and personalisation
Abstract
The invention provides a method for identifying machine operation behaviors, which comprises the following steps: acquiring user operation behavior data to obtain the time of the user for generating operation behavior; generating a time sequence of the user according to the time of the operation behavior of the user; and identifying machine operation behaviors according to the time sequence of the user and the corresponding statistical data of the user operation behaviors, wherein the machine operation behaviors are used for simulating the operation behaviors generated by the user. The embodiment of the invention also discloses a device for identifying the machine operation behavior. By adopting the method and the device, the machine operation behavior data in the user operation behavior data can be effectively identified.
Description
Technical field
The present invention relates to Computer Applied Technology field, particularly relate to a kind of method and device of recognition machine operation behavior.
Background technology
In order to make advertisement obtain promotion effect more targetedly, needing gather and analyze user behavior data, determining the interested field of user by gathering the click volume of user to advertising message, then by advertisement promotion corresponding for this field to user.But when gathering user behavior data, third party, in order to obtain private interests, can add machine behavioral data on the basis of user behavior data, by imitating user behavior, click volume being manufactured to particular advertisement, for particular advertisement improves click volume, increasing the popularization rate of advertisement.In prior art, the user behavior data collected is analyzed, judge whether user behavior data is machine behavioral data.Such as, take user behavior data as click volume be example, when the click volume that unique user is added up within the default unit interval exceedes default click volume, prior art then can think that the behavioral data of this user belongs to machine behavioral data; Or when finding the advertising message order homogeneous phase of multiple user's access in Preset Time simultaneously, prior art then can think that the behavioral data of this multiple user belongs to machine behavioral data; Or, prior art accesses advertising message within a preset time interval generation location by gathering unique user determines that the behavioral data of this user belongs to machine behavioral data, such as, if unique user respectively in Beijing and Shanghai access advertising message, then thought that the behavioral data of this user belonged to machine behavioral data in one hour.But, said method third-party deliberately avoid under, machine behavior can be imitated be rationally, cause prior art effectively cannot identify the machine behavioral data mixed in user behavior data, have impact on the final promotion effect of advertisement.
Summary of the invention
The invention provides a kind of method and device of recognition machine operation behavior, effectively can be identified in the machine operation behavioral data in user operation behavioral data.
First aspect present invention provides a kind of method of recognition machine operation behavior, comprising:
Obtain user operation behavioral data, obtain the time that operation behavior occurs user;
Time operation behavior occurring according to described user generates the time series of described user;
According to the statistics recognition machine operation behavior of the time series of described user and the user operation behavior of correspondence, the operation behavior that described machine operation behavior occurs for imitating described user.
In conjunction with the implementation of first aspect present invention, in the first possible implementation of first aspect present invention, the statistics recognition machine operation behavior of the user operation behavior of the described time series according to described user and correspondence, comprising:
The mistiming between operation behavior occurs described user adjacent time is calculated according to the time series of described user;
Add up the number of times that operation behavior occurs user corresponding to described mistiming;
The number of times production Methods curve of operation behavior is there is according to user corresponding to described mistiming and described mistiming;
Obtain in described relation curve and occur that first number of operation behavior occurs the user of peak value, identify described machine operation behavior according to described first number.
In conjunction with the first possible implementation of first aspect present invention, in the implementation that the second of first aspect present invention is possible, described according to the described machine operation behavior of described first number identification, comprising:
Determine that the corresponding very first time is poor according to described relation curve and described first number;
The theoretical value of described first number is obtained according to described relation curve and difference of the described very first time;
The probability of non-user generation operation behavior in first number according to the mathematic interpolation of the theoretical value of described first number and described first number and described first number, the difference of the theoretical value of described first number and described first number is the number of times of described non-user generation operation behavior;
If the probability of described non-user generation operation behavior is more than or equal to predetermined probabilities, then determine that described non-user operation behavior is described machine operation behavior.
In conjunction with the implementation that the second of first aspect present invention is possible, in the third possible implementation of first aspect present invention, if there are at least two peak values in described relation curve, then, before determining that described non-user operation behavior is described machine operation behavior, described method also comprises:
According to the probability of the probability calculation first non-user generation operation behavior of the non-user generation operation behavior of each peak value described, the probability of described first non-user generation operation behavior is the probability appearing at arbitrarily mistiming corresponding to each peak value described;
If the probability of described non-user generation operation behavior is more than or equal to predetermined probabilities, then determines that described non-user operation behavior is described machine operation behavior, comprising:
If the probability of described first non-user generation operation behavior is more than or equal to described predetermined probabilities, then determine that described first non-user generation operation behavior is described machine operation behavior.
In conjunction with the implementation of first aspect present invention, in the 4th kind of possible implementation of first aspect present invention, the statistics recognition machine operation behavior of the user operation behavior of the described time series according to described user and correspondence, comprising:
The second mistiming between operation behavior occurs described user adjacent time is calculated according to the time series of described user;
The seasonal effect in time series standard deviation of described user is calculated according to described second mistiming;
If the seasonal effect in time series standard deviation of described user is less than preset standard difference, then determine that the operation behavior that described user occurs is described machine operation behavior.
Second aspect present invention provides a kind of device of recognition machine operation behavior, comprising:
Acquisition module, for obtaining user operation behavioral data, obtains the time that operation behavior occurs user;
Generation module, the time that operation behavior occurs the user for obtaining according to described acquisition module generates the time series of described user;
Identification module, for the statistics recognition machine operation behavior of the time series of user that generates according to described generation module and the user operation behavior of correspondence, the operation behavior that described machine operation behavior occurs for imitating described user.
In conjunction with the implementation of second aspect present invention, in the first possible implementation of second aspect present invention, described identification module comprises:
First computing unit, the mistiming between the adjacent time that operation behavior occurs for calculating described user according to the time series of described user;
Statistic unit, there is the number of times of operation behavior in user corresponding to mistiming calculated for adding up described first computing unit;
Generation unit, there is the number of times production Methods curve of operation behavior in user corresponding to described mistiming for mistiming of calculating according to described first computing unit and described statistic unit statistics;
For obtaining in described relation curve, recognition unit, occurs that first number of operation behavior occurs the user of peak value, identify described machine operation behavior according to described first number.
In conjunction with the first possible implementation of second aspect present invention, in the implementation that the second of second aspect present invention is possible, described recognition unit, comprising:
First determines subelement, poor for determining the corresponding very first time according to described relation curve and described first number;
Obtain subelement, for obtaining the theoretical value of described first number according to described relation curve and difference of the described very first time;
Computation subunit, for the theoretical value according to described first number and described first number and described first number mathematic interpolation described in the probability of non-user generation operation behavior in first number, the difference of the theoretical value of described first number and described first number is the number of times of described non-user generation operation behavior;
Second determines subelement, if be more than or equal to predetermined probabilities for the probability of described non-user generation operation behavior, then determines that described non-user operation behavior is described machine operation behavior.
In conjunction with the implementation that the second of second aspect present invention is possible, in the third possible implementation of second aspect present invention, described computation subunit, also for the probability of the probability calculation first non-user generation operation behavior of the non-user generation operation behavior according to each peak value described, the probability of described first non-user generation operation behavior is the probability appearing at arbitrarily mistiming corresponding to each peak value described;
Described second determines subelement, if be also more than or equal to described predetermined probabilities for the probability of described first non-user generation operation behavior, then determines that described first non-user generation operation behavior is described machine operation behavior.
In conjunction with the implementation of second aspect present invention, in the 4th kind of possible implementation of second aspect present invention, described identification module comprises:
Second computing unit, the second mistiming between the adjacent time that operation behavior occurs for calculating described user according to the time series of described user;
Described second computing unit, also for calculating the seasonal effect in time series standard deviation of described user according to described second mistiming;
Determining unit, if be less than preset standard difference for the seasonal effect in time series standard deviation of described user, then determines that the operation behavior that described user occurs is described machine operation behavior.
Adopt the present invention, adopt the embodiment of the present invention, by obtaining user operation behavioral data, obtain the time that operation behavior occurs user, time operation behavior occurring according to described user generates the time series of described user, according to the statistics recognition machine operation behavior of the time series of described user and the user operation behavior of correspondence, effectively can be identified in the machine operation behavioral data in user operation behavioral data, improve the accuracy of data analysis, make advertisement promotion more be rich in specific aim, deepen the promotion effect of advertisement.
Accompanying drawing explanation
In order to be illustrated more clearly in the technical scheme of the embodiment of the present invention, below the accompanying drawing used required in describing embodiment is briefly described, apparently, accompanying drawing in the following describes is some embodiments of the present invention, for those of ordinary skill in the art, under the prerequisite not paying creative work, other accompanying drawing can also be obtained according to these accompanying drawings.
Fig. 1 is the schematic flow sheet of an embodiment of the method for a kind of recognition machine operation behavior of the embodiment of the present invention;
Fig. 2 is the schematic flow sheet of another embodiment of the method for a kind of recognition machine operation behavior of the embodiment of the present invention;
Fig. 3 is the relation curve schematic diagram of another embodiment of the method for a kind of recognition machine operation behavior of the embodiment of the present invention;
Fig. 4 is the schematic flow sheet of another embodiment of the method for a kind of recognition machine operation behavior of the embodiment of the present invention;
Fig. 5 is the schematic flow sheet of another embodiment of the method for a kind of recognition machine operation behavior of the embodiment of the present invention;
Fig. 6 is the structural representation of the device of a kind of recognition machine operation behavior of the embodiment of the present invention;
Fig. 7 is the structural representation of the device of the another kind of recognition machine operation behavior of the embodiment of the present invention.
Embodiment
Below in conjunction with the accompanying drawing in the embodiment of the present invention, be clearly and completely described the technical scheme in the embodiment of the present invention, obviously, described embodiment is the present invention's part embodiment, instead of whole embodiments.Based on the embodiment in the present invention, those of ordinary skill in the art, not making the every other embodiment obtained under creative work prerequisite, belong to the scope of protection of the invention.
Adopt the embodiment of the present invention, effectively can be identified in the machine operation behavioral data in user operation behavioral data.
Term " first ", " second ", " the 3rd " and " the 4th " etc. in instructions of the present invention and claims and above-mentioned accompanying drawing are for distinguishing different object, instead of for describing particular order.In addition, term " comprises " and " having " and their any distortion, and intention is to cover not exclusive comprising.Such as contain the process of series of steps or unit, method, system, product or equipment and be not defined in the step or unit listed, but also comprise the step or unit do not listed alternatively, or also comprise alternatively for other intrinsic step of these processes, method, product or equipment or unit.
Refer to Fig. 1, Fig. 1 is the schematic flow sheet of an embodiment of the method for a kind of recognition machine operation behavior of the embodiment of the present invention.The embodiment of the present invention realizes by central processing unit (CPU, CentralProcessingUnit).Its processor can be applicable to mobile phone, panel computer, notebook computer, palm PC, mobile internet device (MID, mobileinternetdevice), wearable device (such as intelligent watch (as iwatch etc.), Intelligent bracelet, passometer etc.) or other can carry out the terminal device of analyze to data.
As shown in Figure 1, Fig. 1 is the schematic flow sheet of an embodiment of the method for a kind of recognition machine operation behavior of the embodiment of the present invention.
S100, obtains user operation behavioral data, obtains the time that operation behavior occurs user.
In specific implementation, processor can obtain the operation behavior data of all users, from the operation behavior data of all users, filter out the time that operation behavior occurs user.
As the enforceable mode of one, processor can be classified according to the operation behavior data of user characteristics to all users, filter out the time that operation behavior occurs user, user characteristics such as can be the identify label (id of user, identification), identify label such as can be the information that user account, user biological characteristic information etc. can distinguish user identity.
S101, time operation behavior occurring according to described user generates the time series of described user.
In specific implementation, after processor gets the time that operation behavior occurs user, the time that user is occurred operation behavior sorts, and generates the time series of user.Such as, the user operation behavioral data got with processor comprises the operation behavior data instance of a user, processor is classified according to user account respectively according to user operation behavioral data, obtain the time that operation behavior occurs one of them user (such as a user), now can there is the time series of the time generation a user of operation behavior in processor respectively according to a user.
S102, according to the statistics recognition machine operation behavior of the time series of described user and the user operation behavior of correspondence, the operation behavior that described machine operation behavior occurs for imitating described user.
In specific implementation, processor can identify machine operation behavior according to the statistics of the user operation behavior of the time series of user and correspondence, wherein, the operation behavior that machine operation behavior occurs for imitating user, to improve the number of times that operation behavior occurs user.Concrete, processor can identify the machine operation behavior of mixing in the operation behavior that all users occur according to the statistics of the user operation behavior of the time series of a user and correspondence, or processor can identify the machine operation behavior of mixing in the operation behavior of a user's generation according to the statistics of the time series of a user and the user operation behavior of correspondence respectively.Wherein, the statistics of corresponding user operation behavior can be described machine operation behavior and mixes the probability in the operation behavior of user's generation, or the statistics of corresponding user operation behavior can be the seasonal effect in time series standard deviation of user.
Adopt the embodiment of the present invention, by obtaining user operation behavioral data, obtain the time that operation behavior occurs user, time operation behavior occurring according to described user generates the time series of described user, according to the statistics recognition machine operation behavior of the time series of described user and the user operation behavior of correspondence, effectively can be identified in the machine operation behavioral data in user operation behavioral data, improve the accuracy of data analysis, make advertisement promotion more be rich in specific aim, deepen the promotion effect of advertisement.
Refer to Fig. 2, Fig. 2 is the schematic flow sheet of another embodiment of the method for a kind of recognition machine operation behavior of the embodiment of the present invention.
As shown in Figure 2, another embodiment of the method for a kind of recognition machine operation behavior of the embodiment of the present invention can comprise the following steps.
S200, obtains user operation behavioral data, obtains the time that operation behavior occurs user.
In specific implementation, processor can obtain the operation behavior data of all users, from the operation behavior data of all users, filter out the time that operation behavior occurs user.
As the enforceable mode of one, processor can be classified according to the operation behavior data of user characteristics to all users, filter out the time that operation behavior occurs user, user characteristics such as can be the identify label of user, and identify label such as can be the information that user account, user biological characteristic information etc. can distinguish user identity.
S201, time operation behavior occurring according to described user generates the time series of described user.
In specific implementation, after processor gets the time that operation behavior occurs user, the time that user is occurred operation behavior sorts, and generates the time series of user.Such as, the user operation behavioral data got for processor comprises the operational data of a user, b user and c user, processor is classified according to user account respectively according to user operation behavioral data, obtain time of operation behavior of a user, b user and c user, the time that now processor according to a user, b user and c user operation behavior can occur respectively generates the time series of a user, b user and c user.
S202, calculates the mistiming between operation behavior occurs described user adjacent time according to the time series of described user.
In specific implementation, after processor generates the time series of a user, b user and c user, calculate the mistiming between operation behavior occurs a user, b user and c user adjacent time respectively.Such as, the time that operation behavior occurs processor acquisition a user is 8:00:00,8:00:01,8:00:08,8:01:08,8:04:00,8:09:01, and the mistiming of its adjacent time is respectively 1 second, 7 seconds, 60 seconds, 172 seconds and 301 seconds; The time that operation behavior occurs b user is 7:55:09,8:05:00,8:14:51,8:24:42,8:34:33,8:44:24, and the mistiming of its adjacent time is respectively 591 seconds, 591 seconds, 591 seconds, 591 seconds and 591 seconds; The time that operation behavior occurs c user is 8:00:00,8:00:01,8:00:02,8:00:09,8:01:09,8:01:10, and the mistiming of its adjacent time is respectively 1 second, 1 second, 7 seconds, 60 seconds and 1 second.
S203, adds up the number of times that operation behavior occurs user corresponding to described mistiming.
In specific implementation, processor obtains the mistiming between operation behavior occurs each user time, and counts the number of times that operation behavior occurs all users corresponding to each mistiming.Such as, from above-mentioned steps, mistiming is the number of times that operation behavior occurs for the user of 1 second is 4, mistiming is the number of times that operation behavior occurs for the user of 7 seconds is 2, mistiming is the number of times that operation behavior occurs for the user of 60 seconds is 2, mistiming is the number of times that operation behavior occurs for the user of 172 seconds is 1, and the mistiming is the number of times that operation behavior occurs for the user of 301 seconds is 1, and the mistiming is the number of times that operation behavior occurs for the user of 591 seconds is then 5.
, there is the number of times production Methods curve of operation behavior according to user corresponding to described mistiming and described mistiming in S204.
In specific implementation, can the mistiming as horizontal ordinate, the number of times that operation behavior occurs user corresponding to mistiming is ordinate production Methods curve, multiple user operation behavioral data is obtained for processor, be illustrated in figure 3 the relation curve schematic diagram that processor generates according to the number of times that operation behavior occurs user corresponding to mistiming and mistiming, can know that graph of relation is approximate in Poisson distribution (PoissonDistribution) by Fig. 3.Poisson distribution be a kind of statistics with Probability in the common discrete probability distribution arrived, be applicable to describe the number of times that in the unit interval, random occurrence occurs.For the present invention, then there is the number of times of operation behavior for being described in user in mistiming of counting in Poisson distribution.
S205, obtains in described relation curve and occurs that first number of operation behavior occurs the user of peak value.
In specific implementation, can obtain in the graph of relation of Fig. 3 and occur that the actual value of first number of operation behavior occurs the user of peak value.The feature of Poisson distribution is after appearance first peak value, along with the increase curve of abscissa value gently declines gradually, when there are other peak values in the mild decline process at curve, then can judge that the user that this peak value is corresponding occurs to there is machine operation behavior in the number of times of operation behavior.Such as, the actual value that first number of operation behavior occurs the user of one of them peak value that processor can obtain in Fig. 3 is 110000.
As the enforceable mode of one, step S205 both can perform before step S206, and also can perform before step S208, the present embodiment then repeats no more.
According to described relation curve and described first number, S206, determines that the corresponding very first time is poor.
In specific implementation, it is poor to search the very first time corresponding with first number in graph of relation as shown in Figure 3.Such as, the actual value that first number of operation behavior occurs the user that processor gets one of them peak value is after 110000, and the mistiming obtaining corresponding horizontal ordinate is approximately 30 minutes.
S207, obtains the theoretical value of described first number according to described relation curve and difference of the described very first time.
In specific implementation, processor can try to achieve probability function corresponding to relation curve according to relation curve
the theoretical value that first number of operation behavior occurs user is obtained again according to the 30 minutes mistimings of horizontal ordinate got and the probability function of trying to achieve.The theoretical value that first number of operation behavior occurs according to probability function calculating user is prior art, and the present embodiment then repeats no more.
S208, the probability of non-user generation operation behavior in first number according to the mathematic interpolation of the theoretical value of described first number and described first number and described first number, the difference of the theoretical value of described first number and described first number is the number of times of described non-user generation operation behavior.
In specific implementation, after the actual value obtaining first number respectively when processor and theoretical value, calculate the difference between the actual value of first number and theoretical value, wherein, difference between the actual value of first number and theoretical value is the number of times of non-user generation operation behavior, then according to the probability of the mathematic interpolation non-user generation operation behavior between the actual value of first number and first number and theoretical value.
S209, if the probability of described non-user generation operation behavior is more than or equal to predetermined probabilities, then determines that described non-user operation behavior is described machine operation behavior.
In specific implementation, after processor calculates the probability of non-user generation operation behavior, the probability of non-user generation operation behavior and predetermined probabilities are compared, if not the probability that operation behavior occurs user is more than or equal to predetermined probabilities, then determine that the operation behavior that non-user occurs is machine operation behavior, and determine that the probability of non-user generation operation behavior is the probability of machine generation operation behavior.Due to the number of times that the difference between the actual value of first number and theoretical value is non-user generation operation behavior, therefore also can determine that the difference between the actual value of first number and theoretical value is the number of times of machine generation operation behavior.
As the enforceable mode of one, if not the probability that operation behavior occurs user is less than predetermined probabilities, then think that the number of times of the operation behavior that non-user occurs is within analyzable scope, such as, in Fig. 3, the peak value that occurs is just within analyzable scope the mistiming of 1 second, and processor can carry out statistical study by the user corresponding according to the peak value of mistiming of 1 second appearance number of times that operation behavior occurs.
Adopt the embodiment of the present invention, the number of times production Methods curve of operation behavior is there is by obtaining user corresponding to mistiming between operation behavior occurs user adjacent time and mistiming, utilize in relation curve and occur that abnormal peak value calculates the probability of non-user generation operation behavior in first time number, judge that non-user generation operation behavior is as machine operation behavior according to the probability calculated, effectively can be identified in the machine operation behavioral data in user operation behavioral data, improve the accuracy of data analysis, advertisement promotion is made more to be rich in specific aim, deepen the promotion effect of advertisement.
Refer to Fig. 4, Fig. 4 is the schematic flow sheet of another embodiment of the method for a kind of recognition machine operation behavior of the embodiment of the present invention.Fig. 4 embodiment further improves on the basis of Fig. 3, by there being the probability of non-user generation operation behavior in probability calculation at least two peak values of calculating non-user generation operation behavior in single peak value, will be described in detail below more.
As shown in Figure 4, another embodiment of the method for a kind of recognition machine operation behavior of the embodiment of the present invention can comprise the following steps.
S400, obtains user operation behavioral data, obtains the time that operation behavior occurs user.
S401, time operation behavior occurring according to described user generates the time series of described user.
S402, calculates the mistiming between operation behavior occurs described user adjacent time according to the time series of described user.
S403, adds up the number of times that operation behavior occurs user corresponding to described mistiming.
, there is the number of times production Methods curve of operation behavior according to user corresponding to described mistiming and described mistiming in S404.
S405, obtains in described relation curve and occurs that first number of operation behavior occurs the user of peak value.
According to described relation curve and described first number, S406, determines that the corresponding very first time is poor.
S407, obtains the theoretical value of described first number according to described relation curve and difference of the described very first time.
S408, the probability of non-user generation operation behavior in first number according to the mathematic interpolation of the theoretical value of described first number and described first number and described first number, the difference of the theoretical value of described first number and described first number is the number of times of described non-user generation operation behavior.
In specific implementation, the step S400 to step S408 of the present embodiment can the step S200 of detailed in Example Fig. 2 to step S208, the present embodiment then repeats no more.
S409, if there are at least two peak values in described relation curve, then according to the probability of the probability calculation first non-user generation operation behavior of the non-user generation operation behavior of each peak value described, the probability of described first non-user generation operation behavior is the probability appearing at arbitrarily mistiming corresponding to each peak value described.
In specific implementation, as shown in Figure 3, if there are at least two peak values in relation curve, peak value has been there is respectively in the mistiming of such as horizontal ordinate when 10 minutes, 20 minutes and 30 minutes, then processor can distinguish second number that operation behavior occurs the acquisition time difference user corresponding 10 minutes, 20 minutes and 30 minutes, then according to step S205 to step S208 account form respectively computing time difference in the probability P of the non-user generation operation behavior of 10 minutes, 20 minutes and 30 minutes
10, P
20and P
30.Finally, by probability P
10, P
20and P
30substitute into formula P=1-Π (1-P
i), (P is the probability of the first non-user generation operation behavior, P
ifor the probability of the non-user generation operation behavior of mistiming corresponding to each peak value, Π takes advantage of symbol for connecting), the probability of the first non-user generation operation behavior obtained is P=1-(1-P
10) (1-P
20) (1-P
30).Wherein, the probability of the first non-user generation operation behavior is appear at arbitrarily the probability that the mistiming is 10 minutes, 20 minutes and 30 minutes.
S410, if the probability of described first non-user generation operation behavior is more than or equal to described predetermined probabilities, then determines that described first non-user generation operation behavior is described machine operation behavior.
In specific implementation, if the probability P of the first non-user generation operation behavior is more than or equal to described predetermined probabilities, then determine that the operation behavior that the first non-user occurs is machine operation behavior, and determine that the probability of the first non-user generation operation behavior is the probability of machine generation operation behavior.The number of times sum that the number of times of machine generation operation behavior then by the probability P of the first non-user generation operation behavior and the user of all peak values, operation behavior occurs is tried to achieve, and the probability P of the number of times sum and the first non-user generation operation behavior that such as operation behavior occur according to the mistiming the user of 10 minutes, 20 minutes and 30 minutes obtains the number of times of machine generation operation behavior.
As the enforceable mode of one, if the probability of the first non-user generation operation behavior is less than predetermined probabilities, then think that the number of times of the operation behavior that the first non-user occurs is within analyzable scope, such as, in Fig. 3, the peak value that occurs is just within analyzable scope the mistiming of 1 second, and processor can carry out statistical study by the user corresponding according to the peak value of mistiming of 1 second appearance number of times that operation behavior occurs.
Adopt the embodiment of the present invention, the number of times production Methods curve of operation behavior is there is by obtaining user corresponding to mistiming between operation behavior occurs user adjacent time and mistiming, utilize in relation curve the probability of the probability calculation first non-user generation operation behavior of the non-user generation operation behavior occurring each abnormal peak value, the probability of described first non-user generation operation behavior is the probability appearing at arbitrarily mistiming corresponding to each peak value described, judge that the first non-user generation operation behavior is as machine operation behavior according to the probability calculated, effectively can be identified in the machine operation behavioral data in user operation behavioral data, improve the accuracy of data analysis, advertisement promotion is made more to be rich in specific aim, deepen the promotion effect of advertisement.
Refer to Fig. 5, Fig. 5 is the schematic flow sheet of another embodiment of the method for a kind of recognition machine operation behavior of the embodiment of the present invention.
As shown in Figure 5, another embodiment of the method for a kind of recognition machine operation behavior of the embodiment of the present invention can comprise the following steps.
S500, obtains user operation behavioral data, obtains the time that operation behavior occurs user.
In specific implementation, processor can obtain the operation behavior data of all users, from the operation behavior data of all users, filter out the time that operation behavior occurs user.Such as, the time of operation behavior occurs processor acquisition a user is 8:00:00,8:00:01,8:00:08,8:01:08,8:04:00,8:09:01; The time that operation behavior occurs processor acquisition b user is 7:55:09,8:05:00,8:14:51,8:24:42,8:34:33,8:44:24.
S501, time operation behavior occurring according to described user generates the time series of described user.
In specific implementation, there is the time series of the time generation a user of operation behavior in processor according to a user.The time series of the time generation b user of operation behavior is there is in processor according to b user.
S502, calculates the second mistiming between operation behavior occurs described user adjacent time according to the time series of described user.
In specific implementation, the mistiming that processor calculates adjacent time according to the time series of a user is respectively 1 second, 7 seconds, 60 seconds, 172 seconds and 301 seconds, and the mistiming calculating adjacent time according to the time series of b user is respectively 591 seconds, 591 seconds, 591 seconds, 591 seconds and 591 seconds.
S503, calculates the seasonal effect in time series standard deviation of described user according to described second mistiming.
In specific implementation, the seasonal effect in time series standard deviation of processor usable criterion difference formulae discovery user, its standard deviation formula is
wherein, ∑ is continuous adding operation, μ=(∑ X
j)/N, N is the sum that the time point of operation behavior occurs user, and Xj is i-th the second mistiming (0<j<N) in the time series of user.When processor calculates the seasonal effect in time series standard deviation of a user, then learn N=6, μ=(X
1+ X
2+ X
3+ X
4+ X
5)/N=(1+7+60+172+301)/6 ≈ 90, then calculate standard deviation sigma according to N, Xj and the μ that calculates.Therefore the seasonal effect in time series standard deviation obtaining a user is σ
athe seasonal effect in time series standard deviation of ≈ 106, b user is σ
b=0.Wherein, the method calculating the seasonal effect in time series standard deviation of b user and the seasonal effect in time series standard deviation of a user is identical, and the present embodiment then repeats no more.
S504, if the seasonal effect in time series standard deviation of described user is less than preset standard difference, then determines that the operation behavior that described user occurs is described machine operation behavior.
In specific implementation, if the seasonal effect in time series standard deviation of user is less than preset standard difference, represents that the time that operation behavior occurs this user tends towards stability, then can determine that the operation behavior that this user occurs is machine operation behavior.The seasonal effect in time series standard deviation of such as b user is σ
b=0, then determine that the operation behavior that b user occurs is machine operation behavior.
Adopt the embodiment of the present invention, whether seasonal effect in time series standard deviation operation behavior occurring by calculating user judges that operation behavior occurs user is machine operation behavior, effectively can be identified in the machine operation behavioral data in user operation behavioral data, improve the accuracy of data analysis, make advertisement promotion more be rich in specific aim, deepen the promotion effect of advertisement.
Refer to Fig. 6, Fig. 6 is the structural representation of the device of a kind of recognition machine operation behavior of the embodiment of the present invention.The device of recognition machine operation behavior as shown in Figure 6 comprises acquisition module 600, generation module 601 and identification module 602.
Acquisition module 600, for obtaining user operation behavioral data, obtains the time that operation behavior occurs user;
Generation module 601, the time that operation behavior occurs the user for obtaining according to described acquisition module 600 generates the time series of described user;
Identification module 602, for the statistics recognition machine operation behavior of the time series of user that generates according to described generation module 601 and the user operation behavior of correspondence, the operation behavior that described machine operation behavior occurs for imitating described user.
In specific implementation, processor can obtain the operation behavior data of all users, from the operation behavior data of all users, filter out the time that operation behavior occurs user.
As the enforceable mode of one, processor can be classified according to the operation behavior data of user characteristics to all users, filter out the time that operation behavior occurs user, user characteristics such as can be the identify label of user, and identify label such as can be the information that user account, user biological characteristic information etc. can distinguish user identity.
In specific implementation, after processor gets the time that operation behavior occurs user, the time that user is occurred operation behavior sorts, and generates the time series of user.Such as, the user operation behavioral data got with processor comprises the operation behavior data instance of a user, b user and c user, processor is classified according to user account respectively according to user operation behavioral data, obtain the time that operation behavior occurs for a user, b user and c user, the time that now processor according to a user, b user and c user operation behavior can occur respectively generates the time series of a user, b user and c user.
In specific implementation, processor can identify machine operation behavior according to the statistics of the user operation behavior of the time series of user and correspondence, wherein, the operation behavior that machine operation behavior occurs for imitating user, to improve the number of times that operation behavior occurs user.Concrete, processor can identify the machine operation behavior of mixing in the operation behavior that all users occur according to the statistics of a user, b user and the time series of c user and the user operation behavior of correspondence, or processor can identify the machine operation behavior of mixing in the operation behavior that a user, b user and c user occur according to the statistics of a user, b user and the time series of c user and the user operation behavior of correspondence respectively.Wherein, the statistics of corresponding user operation behavior can be described machine operation behavior and mixes the probability in the operation behavior of user's generation, or the statistics of corresponding user operation behavior can be the seasonal effect in time series standard deviation of user.
As the enforceable mode of one, as shown in Figure 7, described identification module 602 comprises the first computing unit 6020, statistic unit 6021, generation unit 6022 and recognition unit 6023.
First computing unit 6020, the mistiming between the adjacent time that operation behavior occurs for calculating described user according to the time series of described user;
Statistic unit 6021, there is the number of times of operation behavior in user corresponding to mistiming calculated for adding up described first computing unit 6020;
Generation unit 6022, there is the number of times production Methods curve of operation behavior in user corresponding to described mistiming added up for mistiming of calculating according to described first computing unit 6020 and described statistic unit 6021;
For obtaining in described relation curve, recognition unit 6023, occurs that first number of operation behavior occurs the user of peak value, identify described machine operation behavior according to described first number.
As the enforceable mode of one, described recognition unit 6023, comprise first determine subelement (not shown), obtain subelement (not shown), computation subunit (not shown) and second determines subelement (not shown).
First determines subelement (not shown), poor for determining the corresponding very first time according to described relation curve and described first number;
Obtain subelement (not shown), for obtaining the theoretical value of described first number according to described relation curve and difference of the described very first time;
Computation subunit (not shown), for the theoretical value according to described first number and described first number and described first number mathematic interpolation described in the probability of non-user generation operation behavior in first number, the difference of the theoretical value of described first number and described first number is the number of times of described non-user generation operation behavior;
Second determines subelement (not shown), if be more than or equal to predetermined probabilities for the probability of described non-user generation operation behavior, then determines that described non-user operation behavior is described machine operation behavior.
As the enforceable mode of one, described computation subunit (not shown), also for the probability of the probability calculation first non-user generation operation behavior of the non-user generation operation behavior according to each peak value described, the probability of described first non-user generation operation behavior is the probability appearing at arbitrarily mistiming corresponding to each peak value described;
Described second determines subelement, if be also more than or equal to described predetermined probabilities for the probability of described first non-user generation operation behavior, then determines that described first non-user generation operation behavior is described machine operation behavior.
As the enforceable mode of one, as shown in Figure 7, described identification module 602 comprises the second computing unit 6024 and determining unit 6025.
Second computing unit 6024, the second mistiming between the adjacent time that operation behavior occurs for calculating described user according to the time series of described user;
Described second computing unit 6024, also for calculating the seasonal effect in time series standard deviation of described user according to described second mistiming;
Determining unit 6025, if be less than preset standard difference for the seasonal effect in time series standard deviation of described user, then determines that the operation behavior that described user occurs is described machine operation behavior.
In specific implementation, the specific embodiment of above-mentioned module, unit or subelement can detailed in Example Fig. 2 to Fig. 5, and the present embodiment then repeats no more.
Adopt the embodiment of the present invention, by obtaining user operation behavioral data, obtain the time that operation behavior occurs user, time operation behavior occurring according to described user generates the time series of described user, according to the statistics recognition machine operation behavior of the time series of described user and the user operation behavior of correspondence, effectively can be identified in the machine operation behavioral data in user operation behavioral data, improve the accuracy of data analysis, make advertisement promotion more be rich in specific aim, deepen the promotion effect of advertisement.
In the description of this instructions, specific features, structure, material or feature that the description of reference term " embodiment ", " some embodiments ", " example ", " concrete example " or " some examples " etc. means to describe in conjunction with this embodiment or example are contained at least one embodiment of the present invention or example.In this manual, to the schematic representation of above-mentioned term not must for be identical embodiment or example.And the specific features of description, structure, material or feature can combine in one or more embodiment in office or example in an appropriate manner.In addition, when not conflicting, the feature of the different embodiment described in this instructions or example and different embodiment or example can carry out combining and combining by those skilled in the art.
In addition, term " first ", " second " only for describing object, and can not be interpreted as instruction or hint relative importance or imply the quantity indicating indicated technical characteristic.Thus, be limited with " first ", the feature of " second " can express or impliedly comprise at least one this feature.In describing the invention, the implication of " multiple " is at least two, such as two, three etc., unless otherwise expressly limited specifically.
Describe and can be understood in process flow diagram or in this any process otherwise described or method, represent and comprise one or more for realizing the module of the code of the executable instruction of the step of specific logical function or process, fragment or part, and the scope of the preferred embodiment of the present invention comprises other realization, wherein can not according to order that is shown or that discuss, comprise according to involved function by the mode while of basic or by contrary order, carry out n-back test, this should understand by embodiments of the invention person of ordinary skill in the field.
In flow charts represent or in this logic otherwise described and/or step, such as, the sequencing list of the executable instruction for realizing logic function can be considered to, may be embodied in any computer-readable medium, for instruction execution system, device or equipment (as computer based system, comprise the system of processor or other can from instruction execution system, device or equipment instruction fetch and perform the system of instruction) use, or to use in conjunction with these instruction execution systems, device or equipment.With regard to this instructions, " computer-readable medium " can be anyly can to comprise, store, communicate, propagate or transmission procedure for instruction execution system, device or equipment or the device that uses in conjunction with these instruction execution systems, device or equipment.The example more specifically (non-exhaustive list) of computer-readable medium comprises following: the electrical connection section (electronic installation) with one or more wiring, portable computer diskette box (magnetic device), random access memory (RAM), ROM (read-only memory) (ROM), erasablely edit ROM (read-only memory) (EPROM or flash memory), fiber device, and portable optic disk ROM (read-only memory) (CDROM).In addition, computer-readable medium can be even paper or other suitable media that can print described program thereon, because can such as by carrying out optical scanning to paper or other media, then carry out editing, decipher or carry out process with other suitable methods if desired and electronically obtain described program, be then stored in computer memory.
Should be appreciated that each several part of the present invention can realize with hardware, software, firmware or their combination.In the above-described embodiment, multiple step or method can with to store in memory and the software performed by suitable instruction execution system or firmware realize.Such as, if realized with hardware, the same in another embodiment, can realize by any one in following technology well known in the art or their combination: the discrete logic with the logic gates for realizing logic function to data-signal, there is the special IC of suitable combinational logic gate circuit, programmable gate array (PGA), field programmable gate array (FPGA) etc.
Those skilled in the art are appreciated that realizing all or part of step that above-described embodiment method carries is that the hardware that can carry out instruction relevant by program completes, described program can be stored in a kind of computer-readable recording medium, this program perform time, step comprising embodiment of the method one or a combination set of.
In addition, each functional unit in each embodiment of the present invention can be integrated in a processing module, also can be that the independent physics of unit exists, also can be integrated in a module by two or more unit.Above-mentioned integrated module both can adopt the form of hardware to realize, and the form of software function module also can be adopted to realize.If described integrated module using the form of software function module realize and as independently production marketing or use time, also can be stored in a computer read/write memory medium.
The above-mentioned storage medium mentioned can be ROM (read-only memory), disk or CD etc.Although illustrate and describe embodiments of the invention above, be understandable that, above-described embodiment is exemplary, can not be interpreted as limitation of the present invention, and those of ordinary skill in the art can change above-described embodiment within the scope of the invention, revises, replace and modification.
Claims (10)
1. a method for recognition machine operation behavior, is characterized in that, comprising:
Obtain user operation behavioral data, obtain the time that operation behavior occurs user;
Time operation behavior occurring according to described user generates the time series of described user;
According to the statistics recognition machine operation behavior of the time series of described user and the user operation behavior of correspondence, the operation behavior that described machine operation behavior occurs for imitating described user.
2. method according to claim 1, is characterized in that, the statistics recognition machine operation behavior of the user operation behavior of the described time series according to described user and correspondence, comprising:
The mistiming between operation behavior occurs described user adjacent time is calculated according to the time series of described user;
Add up the number of times that operation behavior occurs user corresponding to described mistiming;
The number of times production Methods curve of operation behavior is there is according to user corresponding to described mistiming and described mistiming;
Obtain in described relation curve and occur that first number of operation behavior occurs the user of peak value, identify described machine operation behavior according to described first number.
3. method according to claim 2, is characterized in that, described according to the described machine operation behavior of described first number identification, comprising:
Determine that the corresponding very first time is poor according to described relation curve and described first number;
The theoretical value of described first number is obtained according to described relation curve and difference of the described very first time;
The probability of non-user generation operation behavior in first number according to the mathematic interpolation of the theoretical value of described first number and described first number and described first number, the difference of the theoretical value of described first number and described first number is the number of times of described non-user generation operation behavior;
If the probability of described non-user generation operation behavior is more than or equal to predetermined probabilities, then determine that described non-user operation behavior is described machine operation behavior.
4. method according to claim 3, is characterized in that, if there are at least two peak values in described relation curve, then, before determining that described non-user operation behavior is described machine operation behavior, described method also comprises:
According to the probability of the probability calculation first non-user generation operation behavior of the non-user generation operation behavior of each peak value described, the probability of described first non-user generation operation behavior is the probability appearing at arbitrarily mistiming corresponding to each peak value described;
If the probability of described non-user generation operation behavior is more than or equal to predetermined probabilities, then determines that described non-user operation behavior is described machine operation behavior, comprising:
If the probability of described first non-user generation operation behavior is more than or equal to described predetermined probabilities, then determine that described first non-user generation operation behavior is described machine operation behavior.
5. method according to claim 1, is characterized in that, the statistics recognition machine operation behavior of the user operation behavior of the described time series according to described user and correspondence, comprising:
The second mistiming between operation behavior occurs described user adjacent time is calculated according to the time series of described user;
The seasonal effect in time series standard deviation of described user is calculated according to described second mistiming;
If the seasonal effect in time series standard deviation of described user is less than preset standard difference, then determine that the operation behavior that described user occurs is described machine operation behavior.
6. a device for recognition machine operation behavior, is characterized in that, comprising:
Acquisition module, for obtaining user operation behavioral data, obtains the time that operation behavior occurs user;
Generation module, the time that operation behavior occurs the user for obtaining according to described acquisition module generates the time series of described user;
Identification module, for the statistics recognition machine operation behavior of the time series of user that generates according to described generation module and the user operation behavior of correspondence, the operation behavior that described machine operation behavior occurs for imitating described user.
7. device according to claim 6, is characterized in that, described identification module comprises:
First computing unit, the mistiming between the adjacent time that operation behavior occurs for calculating described user according to the time series of described user;
Statistic unit, there is the number of times of operation behavior in user corresponding to mistiming calculated for adding up described first computing unit;
Generation unit, there is the number of times production Methods curve of operation behavior in user corresponding to described mistiming for mistiming of calculating according to described first computing unit and described statistic unit statistics;
For obtaining in described relation curve, recognition unit, occurs that first number of operation behavior occurs the user of peak value, identify described machine operation behavior according to described first number.
8. device according to claim 7, is characterized in that, described recognition unit, comprising:
First determines subelement, poor for determining the corresponding very first time according to described relation curve and described first number;
Obtain subelement, for obtaining the theoretical value of described first number according to described relation curve and difference of the described very first time;
Computation subunit, for the theoretical value according to described first number and described first number and described first number mathematic interpolation described in the probability of non-user generation operation behavior in first number, the difference of the theoretical value of described first number and described first number is the number of times of described non-user generation operation behavior;
Second determines subelement, if be more than or equal to predetermined probabilities for the probability of described non-user generation operation behavior, then determines that described non-user operation behavior is described machine operation behavior.
9. device according to claim 8, is characterized in that,
Described computation subunit, also for the probability of the probability calculation first non-user generation operation behavior of the non-user generation operation behavior according to each peak value described, the probability of described first non-user generation operation behavior is the probability appearing at arbitrarily mistiming corresponding to each peak value described;
Described second determines subelement, if be also more than or equal to described predetermined probabilities for the probability of described first non-user generation operation behavior, then determines that described first non-user generation operation behavior is described machine operation behavior.
10. device according to claim 6, is characterized in that, described identification module comprises:
Second computing unit, the second mistiming between the adjacent time that operation behavior occurs for calculating described user according to the time series of described user;
Described second computing unit, also for calculating the seasonal effect in time series standard deviation of described user according to described second mistiming;
Determining unit, if be less than preset standard difference for the seasonal effect in time series standard deviation of described user, then determines that the operation behavior that described user occurs is described machine operation behavior.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510634613.5A CN105354721B (en) | 2015-09-29 | 2015-09-29 | Method and device for identifying machine operation behavior |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510634613.5A CN105354721B (en) | 2015-09-29 | 2015-09-29 | Method and device for identifying machine operation behavior |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN105354721A true CN105354721A (en) | 2016-02-24 |
| CN105354721B CN105354721B (en) | 2019-09-06 |
Family
ID=55330688
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510634613.5A Active CN105354721B (en) | 2015-09-29 | 2015-09-29 | Method and device for identifying machine operation behavior |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN105354721B (en) |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108306861A (en) * | 2017-12-29 | 2018-07-20 | 亿阳安全技术有限公司 | It is a kind of to generate the method and device for logging in peak period time reference |
| CN110138638A (en) * | 2019-05-16 | 2019-08-16 | 恒安嘉新（北京）科技股份公司 | A kind of processing method and processing device of network flow |
| CN110795705A (en) * | 2019-10-22 | 2020-02-14 | 武汉极意网络科技有限公司 | Track data processing method, device, equipment and storage medium |
| CN112149036A (en) * | 2020-09-28 | 2020-12-29 | 微梦创科网络科技（中国）有限公司 | Method and system for identifying batch abnormal interaction behaviors |
| CN113608946A (en) * | 2021-08-10 | 2021-11-05 | 国家计算机网络与信息安全管理中心 | Machine behavior identification method based on feature engineering and representation learning |
| CN113722199A (en) * | 2021-09-07 | 2021-11-30 | 上海观安信息技术股份有限公司 | Abnormal behavior detection method and device, computer equipment and storage medium |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101924660A (en) * | 2009-06-09 | 2010-12-22 | 阿尔卡特朗讯公司 | Method and device for detecting network malicious behaviors |
| CN104424433A (en) * | 2013-08-22 | 2015-03-18 | 腾讯科技（深圳）有限公司 | Anti-cheating method and anti-cheating system of application program |
| CN104765874A (en) * | 2015-04-24 | 2015-07-08 | 百度在线网络技术（北京）有限公司 | Method and device for detecting click-cheating |
-
2015
- 2015-09-29 CN CN201510634613.5A patent/CN105354721B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101924660A (en) * | 2009-06-09 | 2010-12-22 | 阿尔卡特朗讯公司 | Method and device for detecting network malicious behaviors |
| CN104424433A (en) * | 2013-08-22 | 2015-03-18 | 腾讯科技（深圳）有限公司 | Anti-cheating method and anti-cheating system of application program |
| CN104765874A (en) * | 2015-04-24 | 2015-07-08 | 百度在线网络技术（北京）有限公司 | Method and device for detecting click-cheating |
Cited By (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108306861A (en) * | 2017-12-29 | 2018-07-20 | 亿阳安全技术有限公司 | It is a kind of to generate the method and device for logging in peak period time reference |
| CN108306861B (en) * | 2017-12-29 | 2022-06-07 | 亿阳安全技术有限公司 | Method and device for generating login peak time reference |
| CN110138638A (en) * | 2019-05-16 | 2019-08-16 | 恒安嘉新（北京）科技股份公司 | A kind of processing method and processing device of network flow |
| CN110795705A (en) * | 2019-10-22 | 2020-02-14 | 武汉极意网络科技有限公司 | Track data processing method, device, equipment and storage medium |
| CN112149036A (en) * | 2020-09-28 | 2020-12-29 | 微梦创科网络科技（中国）有限公司 | Method and system for identifying batch abnormal interaction behaviors |
| CN112149036B (en) * | 2020-09-28 | 2023-11-10 | 微梦创科网络科技（中国）有限公司 | Method and system for identifying batch abnormal interaction behaviors |
| CN113608946A (en) * | 2021-08-10 | 2021-11-05 | 国家计算机网络与信息安全管理中心 | Machine behavior identification method based on feature engineering and representation learning |
| CN113608946B (en) * | 2021-08-10 | 2023-09-12 | 国家计算机网络与信息安全管理中心 | Machine behavior recognition method based on feature engineering and representation learning |
| CN113722199A (en) * | 2021-09-07 | 2021-11-30 | 上海观安信息技术股份有限公司 | Abnormal behavior detection method and device, computer equipment and storage medium |
| CN113722199B (en) * | 2021-09-07 | 2024-01-30 | 上海观安信息技术股份有限公司 | Abnormal behavior detection method, device, computer equipment and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN105354721B (en) | 2019-09-06 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN105354721A (en) | Method and device for identifying machine operation behavior | |
| CN107404408B (en) | Virtual identity association identification method and device | |
| CN105023165A (en) | Method, device and system for controlling release tasks in social networking platform | |
| CN105631538A (en) | User activity prediction method and device, and application method and system thereof | |
| CN106294105A (en) | Brush amount tool detection method and apparatus | |
| CN104133765B (en) | The test case sending method of network activity and test case server | |
| CN109165691A (en) | Training method, device and the electronic equipment of the model of cheating user for identification | |
| CN108563670A (en) | Video recommendation method, device, server and computer readable storage medium | |
| CN106709318A (en) | Recognition method, device and calculation equipment for user equipment uniqueness | |
| CN112052394A (en) | Method, system, terminal device and storage medium for recommending professional content information | |
| CN104408640A (en) | Application software recommending method and apparatus | |
| CN110475132A (en) | Direct broadcasting room kind identification method, device and data processing equipment | |
| CN111160624A (en) | User intention prediction method, user intention prediction device and terminal equipment | |
| CN109947874B (en) | Method, device and equipment for aggregating movement tracks | |
| CN106161389B (en) | Cheating identification method and device and terminal | |
| CN113886721B (en) | Personalized interest point recommendation method and device, computer equipment and storage medium | |
| CN105429792A (en) | User behavior flow obtaining method and device and user behavior analysis method and system | |
| CN106156173A (en) | Cheating identification method and device and terminal | |
| CN106933905B (en) | Method and device for monitoring webpage access data | |
| CN107368696B (en) | Question analysis method and device and terminal equipment | |
| CN110876072A (en) | Batch registered user identification method, storage medium, electronic device and system | |
| CN107679222A (en) | Image processing method, mobile terminal and computer-readable recording medium | |
| CN110619090A (en) | Regional attraction assessment method and device | |
| CN114331388B (en) | Salary calculation method, device, equipment and storage medium based on federal learning | |
| CN103793427A (en) | Method and equipment for determining optimized presenting keyword of object presenting keyword |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |